host-install: install the sudo package for the non-root agent model (visudo+sudo)

A host that previously ran the agent as root+direct has no sudo package, so visudo
and runtime sudo -n are missing. step_agent_install now apt-get installs sudo before
the sudoers/unit, and resolves visudo by absolute path (non-login SSH PATH gap).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/felhom-host-install.sh

@@ -538,6 +538,23 @@ step_agent_install() {
         fi
     fi
 
+    # The non-root model REQUIRES the `sudo` package (provides both `sudo` and `visudo`). A host that
+    # previously ran the agent as root+`direct` won't have it installed. Install it idempotently before
+    # the sudoers (visudo validates it) and before the daemon starts (it shells out via `sudo -n`).
+    if ! command -v sudo >/dev/null 2>&1 || ! command -v visudo >/dev/null 2>&1; then
+        if $DRY_RUN; then
+            log_dry "apt-get install -y sudo   # required for the non-root agent (provides sudo + visudo)"
+        else
+            log_info "  installing the 'sudo' package (required for the non-root agent model) …"
+            DEBIAN_FRONTEND=noninteractive apt-get install -y -q sudo >/dev/null 2>&1 \
+              || { apt-get update -q >/dev/null 2>&1; DEBIAN_FRONTEND=noninteractive apt-get install -y -q sudo >/dev/null 2>&1; } \
+              || die "failed to install the 'sudo' package (needed for the non-root agent)"
+            log_success "  sudo installed ($(sudo --version 2>/dev/null | head -1))"
+        fi
+    fi
+    # Resolve visudo by absolute path too (non-login SSH PATH can miss /usr/sbin).
+    local VISUDO; VISUDO=$(command -v visudo 2>/dev/null || echo /usr/sbin/visudo)
+
     # Service user (system, no login, no home dir creation needed beyond state).
     if $DRY_RUN; then
         log_dry "useradd --system --no-create-home --shell /usr/sbin/nologin $AGENT_USER   # if absent"
@@ -560,11 +577,11 @@ step_agent_install() {
     else
         local sdtmp; sdtmp=$(mktemp -t felhom-sudoers.XXXXXX)
         fetch_raw "configs/felhom-agent.sudoers" "$sdtmp"
-        visudo -cf "$sdtmp" >/dev/null || { rm -f "$sdtmp"; die "fetched sudoers failed visudo -cf — refusing to install"; }
+        "$VISUDO" -cf "$sdtmp" >/dev/null || { rm -f "$sdtmp"; die "fetched sudoers failed visudo -cf — refusing to install"; }
         install -m 0440 -o root -g root "$sdtmp" "$AGENT_SUDOERS"
         rm -f "$sdtmp"
         # re-validate the live drop-in in the full sudoers context
-        visudo -cf /etc/sudoers >/dev/null || die "sudoers invalid after installing $AGENT_SUDOERS"
+        "$VISUDO" -cf /etc/sudoers >/dev/null || die "sudoers invalid after installing $AGENT_SUDOERS"
         log_success "  installed $AGENT_SUDOERS (0440, visudo-validated)"
     fi